11 ms·
actually, TPROXY is very very lightly coupled with iptables. In fact, you can directly use TPROXY without iptables. here's a 50 line kernel module that uses TP
by iakie 9y ago
actually, TPROXY is very very lightly coupled with iptables. In fact, you can directly use TPROXY without iptables.
here's a 50 line kernel module that uses TPROXY to do the samething without touching iptables.
https://pastebin.com/uxUf6MFS https://pastebin.com/uxUf6MFS
looking at the nftables code, I think the only reason nftables doesn't support TPROXY is that no one wrote some of the config parsing / seralization stuff.
- jrochkind1 9y agoSounds like cloudflare might want to start trying to submit some nftables TPROXY support now, so it's there in the vanilla kernel when they end up needing it. :)
- RandomBK 9y agoIt'd expect someone to eventually submit such a patch, though I don't know how urgent this issue is. Iptables isn't going anywhere anytime soon, so Cloudflare can continue to use this method on the edge nodes.